The state parameter will be passed back to your callback as a query string, or in the body, depending on the connection you use. You will need to parse this state parameter in your callback, and make the necessary checks.